13 KiB
REPORT — Tester-2 rehearsal with a pretend household + an independent data-loss hunt (2026-10-20 → 21)
Run 2026-10-20 09:30 UTC → 2026-10-21 ~09:50 UTC. Drafted before the night, finished in the morning. This repo's shared
REPORT.mdwas not touched: a parallel session works in the same clone, and the repo rule says the second session writesREPORT-<topic>.mdonly (the brief asked for both; this line is why one was skipped). Evidence:documentation/audits/rehearsal-2026-10-20/(journal, A0–B10, screens) anddocumentation/audits/dataloss-hunt-2026-10-20/(C1–C3). Architecture read for the claims:07-backup-architecture.md,10-localisation.md,00-capability-map.md(A15).
Five sentences
A pretend household installed a box from the public ISO, linked it, claimed it, put eight apps and about 2 GB of family data on it, used it for a day, and every customer restore path brought its data back. The first night's backups, the clock change, three days off and power cuts in the middle of installs and catch-ups all worked, and the morning data was byte-identical to the evening's. But the 8 GB minimum box froze twice on its first afternoon and only a plug pull helped (R-1192), and the household's warning mails went to the operator instead (R-1199). When the box died, the household could not even start again without the operator, and after the operator's press the rebuilt box could not reach its off-site history at all — proven live (R-1176, P1). Nothing was released; 29 new register rows carry the rest.
The ten places a household gets stuck
documentation/audits/rehearsal-2026-10-20/B10-stuck/README.md. In short:
- The box froze twice on the first afternoon (≈1 h and ≈35 min); only pulling the plug helped (R-1192, P1).
- The bind page needs an owner passphrase the household does not have — 2 h 4 min waiting for the operator.
- A power cut during a full off-site restore leaves the app on the backup's older data; the page only says „interrupted" (R-1195).
- A pulled drive breaks the last uploads (0 bytes or gone) although each was confirmed (R-1196).
- The family's warning mails went to the operator, not the family (R-1199).
- „Ödön" and „Írisz" are refused as family names (W12).
- A new drive needs a „mount name" nobody knows; the button silently does nothing (W13).
- Sharing waits for ever for a password the page never asks for (W21).
- Errors arrive as raw technical English (W22, W25).
- After the box died, the household was promised a mail that never came, and after the operator's press the rebuilt box could not reach the family's off-site data (R-1203, R-1176). (Close behind: three apps' wrong „first steps", W17–W19.)
Data-loss findings, ranked
| row | Sev | harm | reproduced | design / defect |
|---|---|---|---|---|
| R-1175 | P1 | shares on two drives sharing one second drive: every night one drive's share copy is pruned; the night a drive dies its copy is deleted | unit test on production code (C3-D1-shares-tier2/) |
defect |
| R-1176 | P1 | a box rebuilt after „delete the old host" cannot reach its off-site history: no recovery code asked, a new key, the old history set aside on night one | hub store unit test (C3-K1-…) + LIVE in B7 (2026-10-21) |
defect |
| R-1191 | P1 | a .fab import makes a family-only app open to anyone |
LIVE on scratch 9202 | defect (security) |
| R-1192 | P1 | the 8 GB box froze under first-day use; two plug pulls | LIVE on Tester4 (twice) | defect — cause not diagnosed (no shell on the box) |
| R-1177 | P2 | a failed local restore destroys the live data, keeps no copy | LIVE on 9202 | design question (D22 in STATUS) |
| R-1195 | P2 | a power cut mid full off-site restore: app on the backup's data, page says only „interrupted" | LIVE on Tester4 (B6 #2) | defect |
| R-1178 | P2 | second-drive „whole restore" can change files, refuse the DB, leave the app stopped and say „untouched" | unit test | defect |
| R-1180 | P2 | the nightly mirror (rsync --delete) can run during a restore from it |
unit test | defect |
| R-1181 | P2 | a missing app folder deletes its second-drive copy in one night (the only copy for optional folders) | unit test | defect (D23 in STATUS) |
| R-1179 | P2 | a drive marked „away" can still be the second-drive target | code + unit test | defect |
| R-1182 | P2 | abandoning one set-aside off-site copy deletes every retained key package | code | defect |
| R-1199 | P2 | warning mails reach the operator, not the household | LIVE (two mailboxes) | defect |
| R-1204 | P2 | a box that ran once with its clock ahead loses its WireGuard tunnel to ep0 (PBS copies + operator door) until that date | LIVE (B6 #8, ep0 wg show) |
defect |
| R-1203 | P2 | after a box death, the household is promised a link mail that never comes until the operator deletes the old host | LIVE (B7) | defect |
| R-1185 | P3 | a dump that fails its own check has already replaced the good one | unit test (docker stub) | defect (order) |
| R-1186 | P3 | the nightly off-site copy is skipped silently when another backup holds the flag | code | defect |
| R-1184 | P3 | a cut-off shares restore can be reported restored with files missing | code | defect |
| R-1196 | P3 | uploads confirmed just before a drive pull are 0 bytes or gone | LIVE (B6 #4) | defect |
| R-1183 | P3 | on 2026-10-25 every hub daily job runs twice (DB snapshot keep-2 pruned a day early) | replay of the hub's arithmetic | defect (D24 in STATUS) |
| R-1200 | P3 | an afternoon install gets no whole-box backup on night one | LIVE (B5) | design question |
| R-1202 | P3 | a box with its clock behind stops an app silently and only says „Hub nem elérhető" | LIVE (B6 #8) | defect |
| R-1187 … R-1190 | P3 | the unproven candidates of the four reviewers, grouped | code reading | mixed |
Failure scenarios (B6)
| # | scenario | result | evidence |
|---|---|---|---|
| ★1 | power cut mid app install | PASS — clean rollback, honest event, reinstall in 15 s | B6-failures/s1-… |
| ★2 | power cut mid off-site restore | 6 s: safe; 14 s: app on the backup's data, page „interrupted" → R-1195 | s2-… |
| ★3 | data disk 100 % during backup | PASS — warned at 89 %, refused before writing, healed; SMB error unclear; system disk 97 % not run | s3-… |
| ★4 | data drive pulled, put back | apps stopped in 42/34 s, back by themselves; last uploads 0 B/missing → R-1196 | s4-… |
| ★5 | slow lossy line, first big off-site | run failed under 1 Mbit + 5 % loss, raw English; second press OK 3 m 38 s | s5-… |
| ★6 | off-site blocked | failed in 2.5 min, raw English; catch-up OK 2 m 37 s (shortened, not a night) | s6-… |
| ★7 | DST | PASS — the database copy ran once, at the second 02:30; W30 (no summer/winter mark in the repeated hour) | s7-dst/ |
| ★8 | wrong clock at boot ±2 y | FINDINGS — −2 y became −6 months (the OS floor): „Hub nem elérhető" only, Paperless stopped silently (R-1202); +2 y: a whole-box archive dated 2028 (R-1189 a), then the ep0 tunnel dead (R-1204) | s8-wrong-clock/ |
| ★9 | two actions at once | PASS — second action refused with a clear sentence | s9-… |
| ★10 | box off 3 days (+#15 restart in the catch-up) | PASS — ONE catch-up, a clear note to the household, the interrupted catch-up recovered | s10-three-days-off/ |
| 11 | hard reset mid app update | NOT RUN — no update was offered to the box (nothing was released during the run) | — |
| 12 | DNS dead 1 h | PASS for data; operator told after ~37 min, household never | s12-… |
| 13 | second drive added later | not offered as the backup place → R-1198; safe removal OK; blank texts (W29) | s13-… |
| 14 | remove keeping data → reinstall „use kept data" | PASS — 47/47 documents, 47/47 originals | s14-… |
| 16 | English browser / English dashboard | follows the household's setting (by design); a few Hungarian strings → fixed W26 (unreleased) | s16-… |
Restore paths (B8)
All seven customer paths PASS on the live box (B8-restores/README.md): A.1.1 Mealie unit 17 s; A.1.2 Nextcloud from
the second drive 3/3 sha256; A.1.3 Radicale verify copy 5 s; A.1.4 Nextcloud missing-only 3/3 sha256 (NFC/NFD: both
names come back on the share; Nextcloud itself folds NFD into NFC); A.1.5 BookStack full off-site 30 s; A.1.6 shares
2 files; A.1.7 .fab Mealie. Gaps: the messages do not say which point in time or how many files.
Night chain and DST
The first night (B5), no hands: database copy 00:30Z PASS (3 m 27 s); second-drive copy 01:30Z PASS (8 apps + the
share, 58 s); off-site 02:15Z PASS (44 snapshots, 3 m 6 s, nothing deleted; the hub's own listing agrees: 44 files,
newest 02:18Z); whole-box backup NOT RUN — not due under the 24 h rule, because the install's own backup at 12:09Z
started the clock (R-1200, P3: the family's first day reaches a whole-box copy only on the second night). At 02:46Z
demo-hp's own kernel update rebooted the test host and shut the rehearsal VM down (harness, not a Tester4 defect; a BYO
host skips that step by design). Health 200 all night before that; memory steady. The morning data snapshot is
identical to the evening one, byte for byte (B5-night/README.md).
DST (#7), live: the box was started with its clock at 2026-10-25 02:20 CEST and left alone: no database copy at the first 02:30, one at the second (01:30:00Z, 1 m 55 s). The code replay agrees for the box; the hub runs every daily job twice on that day (R-1183, D24) and spring 2027 puts the 02:30 dump on the 03:30 copy (B6-failures/dst-replay/).
Interventions (operator-only acts)
| # | when (UTC) | what | minutes the household waited |
|---|---|---|---|
| 1 | 09:57 → 12:00:57 | the owner passphrase handed over (by design, out of band) | 124 |
| 2 | asked 09:35, done 12:01–12:15 | off-site switched on for Tester4 | 0 (done before the household needed it) |
| 3 | asked 08:59, done ~09:11 (2026-10-21) | delete host Tester4-816e21 before the reinstall (B7) | ~12 (and 17 min of a dead end before it, R-1203) |
Not counted as interventions: the two plug pulls (14:11, 16:13) — a household can do that, and did.
Versions
controller 0.336.0 (7ca59e2, floor), agent 0.161.0 (4e1621c), hub 0.162.0, golden 0.331.0, min_agent 0.158.1,
installer 1.35.0, ISO 1.29.0 (sha256 dceacae5…4829), catalog c50adfc6 (65 templates). Nothing was released, deployed,
vouched, baked or published during the run. One text fix was committed, not released: controller 01c967e (W26).
Browser spike (A4)
Works: Chromium 155 + Playwright 1.52 in a throwaway LXC on demo-hp, phone and computer, HU and EN, in ~12 minutes.
121 screenshots. Limits: no real DNS/TLS for the household's address; not a human. A4-browser/README.md.
Teardown
Machine: VM 9320, CT 9330 and the ISO removed from demo-hp by their own IDs; no drill firewall rules left; memory back
to the start. DooPlex: three watchers stopped by PID. Hub: host Tester4-648b80 is left for the operator to delete
(the customer Tester4 stays). ep0: one PBS snapshot ns/Tester4/ct/9201/2026-10-20T12:17:26Z and the WireGuard peer
10.77.0.6 remain; the Storage Box keeps the household's restic history — listed, nothing removed (D-teardown/).
Secrets (names only)
All in sec, prefix REHEARSAL_2026_10_20_: 9202_PW, 9202_RESETCODE, APP_BOOKSTACK, APP_RADICALE,
APP_VAULTADMIN, BIND_TOKEN, BOOKSTACK_TOKEN, DASH_PW, FAMILY_IRISZ, FAMILY_KATA, FAMILY_ODON,
INSTALL_ROOTPW, IRISZ_PW, KATA_PW, ODON_PW, OLD_BIND_TOKEN, PAIRING_CODE, PASSPHRASE, RECOVERY_CODE,
SETUP_CODE, SMB_PW. Kept (the operator decides); none written anywhere else. Evidence scanned for their values:
0 hits.
Register
Before 153 open rows; now 182. Opened by this run: 29 (R-1175 … R-1200, R-1202, R-1203, R-1204). Closed: R-1019 (a dated
check read on demo-felhom, read-only). One row (R-1201) came from a parallel session. Updated: R-1176 (proven live),
R-1189 (a half-live), R-895 (first verdict), R-435 (moved). Capability map: A15 still PARTIAL with new evidence; A12 and
A13 PROVEN-LIVE → PARTIAL (B7). unproven.py --summary: unchanged (35 of 55 not walked).
Observations
FILED: everything in the tables above. NOT-A-FINDING: the dashboard ignores an English browser (by design: the
household's setting wins); Nextcloud folding NFD into NFC (upstream behaviour; both forms survive on the share); the
films' off-site size (CBR filler compresses; nothing missing); demo-hp's own kernel reboot at 02:46 (a harness effect: a
BYO host skips that step by design, osupdate/leg.go:674). FILED: everything in the tables above.
Harness slips (mine), each recorded in the journal: a screenshot step blanked a form before submit (15 min lost); the
two watcher logs froze at 20:24 when git pull --autostash replaced their files (recovered in full from the open files);
my first #10 start used a date the #7 records had made meaningless (restarted, recorded before any result). Secrets:
the nightly DooPlex sweep found three rehearsal secret values in my session record (the old and new bind tokens and a
setup code — I had read their mails in full and typed one into a sec put); in B7 a second bind link and setup code
entered the record the same way. All are one-time values, spent within minutes; nothing secret is in any committed file
(323 files scanned, 0 hits; pictures checked by eye; the B7 pairing code was blacked out).